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DECISION ON APPEAL 
I. STATEMENT OF THE CASE 
Appellants appeal under 35 U.S.C. § 134(a) from the Examiner's 
Final Rejection of claims 2-14, 16-31, and 36-48. We have jurisdiction 
under 35 U.S.C. § 6(b). We affirm in part. 
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A. Invention 

1 The invention at issue involves fending off undesirable network 
traffic in a network (Spec. 1.) Typically, detecting and filtering out data 
packets associated with a spoof source address has been problematic as 
spoof instances are intermixed with non-spoof instances (Id. 2.) 

In contrast, Appellants' invention provides a network system in which 
routing data packets from spoof source addresses are identified using spatial 
consistency, destination consistency, migration consistency, and temporal 
consistency (Id. 3.) 

B. Illustrative Claims 
Claims 1 and 2, which further illustrate the invention, follow. 

1 . A network comprising: 
a plurality of network nodes; 

a plurality of routing devices to route network traffics between 
selected ones of said network nodes; and 

director coupled to said routing devices to determine whether 
selected instances of source addresses of packets routed by said 
routing devices are spoof source addresses, based at last in part on one 
or more consistency measures. 

2. The network of claim 1, wherein the director bases said 
determination on at least spatial distribution profiles of said source 
addresses, and in view of at least one reference source address spatial 
distribution profile. 
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C. Rejection 

Claims 1-34 and 36-48 stand rejected under 35 U.S.C. § 102(e) as 
being anticipated by U.S. Patent No. 6,321,338 ("Porras"). 

II. CLAIM GROUPING 

T'When multiple claims subject to the same ground of rejection are 
argued as a group by Appellants, the Board may select a single claim from 
the group of claims that are argued together to decide the appeal with respect 
to the group of claims as to the ground of rejection on the basis of the 
selected claim alone. Notwithstanding any other provision of this paragraph, 
the failure of Appellants to separately argue claims which Appellants have 
grouped together shall constitute a waiver of any argument that the Board 
must consider the patentability of any grouped claim separately." 37 C.F.R. 
§41.37(c)(l)(vii) (2005). 1 

Here, Appellants do not argue for the patentability of claims 1 and 1 5 
(the first group). (App. Br. 3). In addition, Appellants argue claims 2, 16, 
and 34, which are subject to the same ground of rejection, as a second group 2 



1 We cite to the version of the Code of Federal Regulations in effect at the 
time of the Appeal Brief. The current version includes the same rules. 

2 Appellants place claims 16 and 34 in different headings in the Appeal Brief 
but rely on the same argument with respect to deficiencies in Porras as 
applied against claim 2. 
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(App. Br. 3-4); claims 3, 17, 19, and 36 as a third group 3 (Id. 4-6); claims 4, 
20, 21, 38, and 39 as a fourth group 4 (Id. 6-7); claims 5 and 23 as a fifth 
group 5 (Id. 7-8); claims 6, 24, and 41 as a sixth group 6 (Id. 8); claims 7 and 
27 as a seventh group 7 (Id. 9-10), claims 8, 28-30, and 44-46 as an eighth 
group 8 (Id. 10-11); claim 9 as a ninth group (Id. 1 1); claim 10 as a tenth 
group (Id. 12); claim 1 1 as a eleventh group (Id. 13); claims 18 and 37 as an 
twelfth group (Id. 5); claims 22 and 40 as a thirteenth group (Id. 6-7); claims 



3 Appellants place claims 17, 19, and 36 in different headings in the Appeal 
Brief but rely on the same argument with respect to deficiencies in Porras as 
applied against claim 3. 

4 Appellants place claims 20, 21, 38 and 39 in different headings in the 
Appeal Brief but rely on the same argument with respect to deficiencies in 
Porras as applied against claim 4. 

5 Appellants place claim 23 in a different heading in the Appeal Brief but 
rely on the same argument with respect to deficiencies in Porras as applied 
against claim 5. 

6 Appellants place claims 24 and 41 in different headings in the Appeal Brief 
but rely on the same argument with respect to deficiencies in Porras as 
applied against claim 6. 

7 Appellants place claim 27 in a different heading in the Appeal Brief but 
rely on the same argument with respect to deficiencies in Porras as applied 
against claim 7. 

8 Appellants place claims 28-30 and 44-46 in different headings in the 
Appeal Brief but rely on the same argument with respect to deficiencies in 
Porras as applied against claim 8. 
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25 and 42 as a fourteenth group {Id. 8-9); and claims 26 and 43 as a fifteenth 
group {Id. 9.) 

In addition, Appellants do not present arguments pertaining to 
claims 12-14, 31, 32, 33, 47, and 48. When the patentability of dependent 
claims in particular is not argued separately, the claims stand or fall with the 
claims from which they depend. In re King, 801 F.2d 1324, 1325 (Fed. Cir. 
1986); In re Sernaker, 702 F.2d 989, 991 (Fed. Cir. 1983). Claims 47 and 
48 depend from claim 34 (of the second group) and are therefore included in 
the second group. Claim 21 depends from claim 28 and is included in the 
eighth group. Claims 12-14, 32, and 33 depend from claim 1 or claim 15 
and are therefore included in the first group. 

III. CLAIMS 1, 12-15, 32, AND 33 
We select claim 1 as the sole claim on which to decide the appeal of 
the first group. Appellants do not argue for patentability of claim 1. 
Therefore, we affirm the Examiner's rejection of claim 1 pro forma, and of 
claims 12-15, 32, and 33, which fall therewith. 

IV. CLAIMS 2, 3, 16-19, 34, AND 36-48 
"Rather than reiterate the positions of parties in toto, we focus on the 
issue therebetween." Ex Parte Filatov, No. 2006-1 160, 2007 WL 1317144, 
at *2 (BPAI 2007). 
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Appellants argue claims 2, 16, and 34 as a group. Claims 3, 17-19, 
and 36-48 depend from claim 2, 16, or 34. We select claim 2 as the sole 
claim on which to decide the appeal of the group. 

Here, the Examiner finds that Porras discloses each element of the 
claimed invention (Ans. 14-16.) Appellants dispute the Examiner's position 
and assert that Porras fails to disclose a determination based upon spatial 
distribution profiles. (App. Br. 3.) 

In response, the Examiner asserts that Porras discloses "continuous 
measures" (col. 5, 11. 36-51; col. 6, 11. 37-58) and further equates the 
"continuous measures" of Porras with Appellants' "spatial distribution 
profile." (Ans. 15). 

Our analysis begins with construing the claim limitations at issue. 
"Claims must be read in view of the specification, of which they are a part." 
Markman v. Westview Instruments, Inc., 52 F.3d 967, 979 (Fed. Cir. 1995) 
(en banc). However, "limitations are not to be read into the claims from the 
specification." In re Van Geuns, 988 F.2d 1181, 1184 (Fed. Cir. 1993) 
(citing In re Zletz, 893 F.2d 319, 321 (Fed. Cir. 1989)). 
1 Here, claim 2 recites in pertinent part the following limitations: "the 
director bases said determination on at least spatial distribution profiles of 
said source address, and in view of at least one reference source address 
spatial distribution profile." Reading the representative claim in view of the 
Specification, the limitations require a spatial distribution profile pertaining 
to a spatial distribution of observed source addresses (e.g., over routing 
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domains) (Spec. 8.) Giving the representative claim the broadest, reasonable 
construction, the limitations require determining that instances of source 
addresses of packets routed by routing devices are spoof source addresses 
based on a spatial distribution profile of the source addresses. Giving the 
term "spatial distribution profile" the broadest, reasonable interpretation 
based on the plain meaning of the terms, we find that a "spatial distribution 
profile" includes a profile that describes the relative placement or location of 
source addresses in space ("distribution" in space) - i.e., the relative 
geographical placement of sources in a network. 

Having construed the claim limitations at issue, we now compare the 
claims to the prior art to determine if the prior art anticipates those claims. 
"[Anticipation of a claim under § 102 can be found only if the prior art 
reference discloses every element of the claim . . . ." In re King, 801 F.2d 
1324, 1326 (Fed. Cir. 1986) (citing Lindemann Maschinenfabrik GMBH v. 
American Hoist & Derrick Co., 730 F.2d 1452, 1458 (Fed. Cir. 1984)). 
"[AJbsence from the reference of any claimed element negates anticipation." 
Kloster Speedsteel AB v. Crucible, Inc., 793 F.2d 1565, 1571 (Fed. Cir. 
1986). 

As the Examiner states, Porras discloses "continuous measures" 
(col. 5, 11. 65-67). However, Porras discloses that the "continuous measures" 
are values that "include inter-event time, . . . , counting measures such as the 
number of errors of a particular type observed in the recent past, the volume 
of data transfers over a period of time, and network traffic measures." 
7 
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(Col. 5, 1. 66 - col. 6, 1. 5). Thus, we find Porras fails to disclose that the 
"continuous measures" include information pertaining to the relative 
placement or location of source addresses in space (i.e., "spatial 
distribution"). 

The absence of the spatial distribution profile negates anticipation. 
Therefore, we reverse the anticipation rejection of claims 2, 16, and 34 and 
of dependent claims 3, 17-19, and 36-48. 

V. CLAIMS 4, 5, AND 20-23 

Appellants argue claims 4, 20, and 21 as a group. Claims 5, 22, and 
23 depend from claim 4 or claim 20. We select claim 4 as the sole claim on 
which to decide the appeal of the group. 

Appellants dispute the Examiner's finding that Porras discloses each 
element of claim 4 and argues that Porras fails to disclose the determination 
being based on at least destination source address range distribution profiles. 
(App. Br. 6). In response, the Examiner asserts that Porras discloses 
"categorical measures" (Ans. 18.) The Examiner further equates the 
"categorical measures" of Porras with the recited destination source address 
range distribution profile (Id.) 

Giving the representative claim the broadest, reasonable construction, 
the limitations require determining that instances of source addresses of 
packets routed by routing devices are spoof source addresses based on a 
destination source address range (DSAR) distribution profiles of the source 
8 
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addresses. Giving the term "destination source address range distribution 
profile" the broadest, reasonable interpretation based on the plain meaning 
of the terms, we find that a "destination source address range distribution 
profile" includes a profile that describes the range of source addresses seen 
at a destination node in relation to ranges of source addresses seen at other 
destination nodes (i.e., the "distribution" of ranges of source addresses seen 
at different destination nodes). 

As the Examiner asserts, Porras discloses "categorical measures" 
which includes "values from a discrete, nonordered set of possibilities." 
(Col. 5, 11. 52-53.) Porras further discloses that the "categorical measures" 
includes "network source and destination addresses, commands . . . , 
protocols, error codes . . . , and port identifiers. (Col. 5, 11. 55-59.) 
However, none of these elements disclosed by Porras appear to equate with a 
"distribution" of ranges of source addresses seen at different destination 
nodes. 

The absence of the destination source address range distribution 
profile negates anticipation. Therefore, we reverse the anticipation rejection 
of claims 4, 20, 21, and of dependent claims 5, 22, and 23. 
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VI. CLAIMS 6, 7, AND 24-27 
Appellants argue claims 6 and 24 as a group. Claims 7 and 25-27 
depend from claim 6 or claim 24. We select claim 6 as the sole claim on 
which to decide the appeal of the group. 

Appellants dispute the Examiner's finding that Porras discloses each 
element of claim 6 and argues that Porras fails to disclose the determination 
being based on "migration distribution profiles for those source addresses 
that are based at least in part [on] a reference migration distribution profile." 
(App. Br. 8). In response, the Examiner asserts that Porras discloses 
"continuous measures" (Ans. 20.) The Examiner further equates the 
"continuous measures" of Porras with the recited "migration distribution 
profiles" (Id.) 

Giving the representative claim the broadest, reasonable construction, 
the limitations require determining that instances of source addresses of 
packets routed by routing devices are spoof source addressed based on a 
migration distribution profile of the source addresses. Giving the term 
"migration distribution profile" the broadest, reasonable interpretation based 
on the plain meaning of the terms, we find that a "migration distribution 
profile" includes a profile that describes the distribution of changes in 
routing paths (i.e., "migration") of data packet transmission across domains. 

As the Examiner asserts, Porras discloses "continuous measures" 
which includes "inter-event time, . . . , counting measures such as the 
number of errors of a particular type observed in the recent past, the volume 
10 
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of data transfers over a period of time, and network traffic measures." 
(Col. 5, 1. 66 - col. 6, 1. 5). However, we find Porras fails to disclose that the 
"continuous measures" includes information pertaining to the distribution of 
changes in routing paths (i.e., "migration") of data packet transmission 
across domains. 

The absence of the migration distribution profile negates anticipation. 
Therefore, we reverse the anticipation rejection of claims 6, 24, and 41 and 
of dependent claims 7 and 25-27. 

VII. CLAIMS 10 AND 11 

Appellants dispute the Examiner's finding that Porras discloses each 
element of claim 10 and argues that Porras fails to disclose that "filtering 
actions are to be taken to filter out packets with source addresses that are 
deemed to be spoofed source addresses." (App. Br. 12). In response, the 
Examiner asserts that although Porras does not disclose filtering packets, 
Porras nevertheless implies filtering actions by disclosing monitoring 
routing devices, detecting spoofing, receiving reports to reconfigure the 
monitoring (Ans. 26). 

The Examiner states that Porras fails to disclose filtering. In addition, 
based on the record before us, it does not appear that Porras discloses the 
claim limitations. Specifically, it does not appear that monitoring devices, 
detecting spoofing, or reconfiguring monitoring based on received reports 
equates with filtering out packets. 
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Therefore, we reverse the anticipation rejection of claim 10. Because 
claim 1 1 depends upon claim 10, we also reverse the Examiner's 
anticipation rejection of claim 11. 

VIII. CLAIMS 8 AND 28-31 

Appellants argue claims 8 and 28-30 as a group. We select claim 8 as 
the sole claim on which to decide the appeal of the group. 

Appellants dispute the Examiner's finding that Porras discloses each 
element of claim 8 and argues that Porras fails to disclose "using timing 
distribution profiles for the packets" (App. Br. 10.) In response, the 
Examiner asserts that Porras discloses "continuous measures" (Ans. 23.) 
The Examiner further equates the "continuous measures" of Porras with the 
recited "timing distribution profiles" (Id.) 

Giving the representative claim the broadest, reasonable construction, 
the limitations require determining that instances of source addresses of 
packets routed by routing devices are spoof source addresses based on a 
timing distribution profile of the source addresses. Giving the term "timing 
distribution profile" the broadest, reasonable interpretation based on the 
plain meaning of the terms, we find that a "timing distribution profile" 
includes a profile that describes the timing of data packet transmission. 

As the Examiner asserts, Porras discloses "continuous measures" 
which includes "inter-event time (e.g., difference in time stamps between 
consecutive events from the same stream), . . . , the volume of data transfers 
12 
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over a period of time . . . ." (Col. 5, 1. 66 - col. 6, 1. 4). Porras further 
discloses the "continuous measures" as including "intensity measures" that 
"reflect the intensity of the event stream (e.g., number of ICMP 9 packets) 
over specified time intervals (e.g., 1 minute, 10 minutes, and 1 hour)." 
(Col. 6, 11. 21-23). Because Porras discloses a profile that describes timing 
of data packet transmission, we agree with the Examiner that Porras 
discloses a "timing distribution profile." 

Because Appellants have failed to demonstrate that the Examiner 
erred in rejection claim 8, we affirm the rejection of claim 8 and of claims 
28-31, which fall therewith. 

IX. CLAIM 9 

Appellants dispute the Examiner's finding that Porras discloses each 
element of claim 9 and argues that Porras "does not teach that spoofed 
source addresses should be identified based on these types of timing 
distribution profiles." (App. Br. 11.) In response, the Examiner asserts that 
Porras discloses "a profile engine using scores to determine how close a 
profile, such as a profile generated from a continuous measure, corresponds 
to a historical profile." (Ans. 25.) 

Giving the representative claim the broadest, reasonable construction, 
the limitations require a timing distribution profile of the source addresses 
having a historical timing distribution profile for a particular source address. 



9 Internet Control Message Protocol 
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Giving the term "timing distribution profile" the broadest, reasonable 
interpretation based on the plain meaning of the terms, we find that a 
"timing distribution profile" includes a profile that describes the timing of 
data packet transmission. 

As the Examiner asserts and as set forth above, Porras discloses 
"continuous measures" which includes profiles containing a "timing 
distribution profile." Also, Porras further discloses that the profiles include 
a statistical score that "represents how closely currently observed usage 
corresponds to the established patterns of usage. (Col. 5, 11. 38-41). Porras 
further discloses that profiles are compared "to a historically adaptive 
deviation." (Col. 6, 11. 63-64). Because Porras discloses a profile that 
describes established patterns of usage and historical data, we agree with the 
Examiner that Porras discloses a historical timing distribution profile. 

We also disagree with Appellants' assertion that Porras fails to 
disclose that "spoofed source addresses should be identified based on these 
types of timing distribution profiles." (App. Br. 11.) Porras discloses that 
the profile contains the timing distribution profile as set forth above and that 
the profile is used to "monitor for attempts to penetrate or interfere with the 
domain's operation" (col. 7, 11. 29-31); scan "the event stream for events that 
represent attempted exploitations of known attacks against the service, or 
other activity that stands alone as warranting a response from the monitor" 
(col. 7, 11. 33-35); "scan the aggregate of intrusion reports from service 
monitors in an attempt to detect more global coordinated attack scenarios or 
14 
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scenarios that exploit interdependencies among network services" (col. 7, 
11. 36-38); or to "detect 'address spoofing'" (col. 14, 11. 16-17). In each of 
these scenarios, Porras discloses identifying attacks, including "address 
spoofing." 

Because Appellants have failed to demonstrate that the Examiner 
erred in rejecting claim 9, we affirm the anticipation rejection of claim 9. 

IV. ORDER 

In summary, the rejection of claims 1, 8, 9, 12-15, and 28-33 under 
§ 102(e) is affirmed. The rejection of claims 2-7, 10, 11, 16-27, and 34-48, 
however, is reversed. 

No time for taking any action connected with this appeal may be 
extended under 37 C.F.R. § 1.136(a)(l)(iv). 

AFFIRMED-IN-PART 



rwk 

HOUSTON ELISEEVA 

4 MILITIA DRIVE, SUITE 4 

LEXINGTON, MA 02421 

15 



